Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers (<= 3.7.4)

The Sunshine Photo Cart plugin for WordPress is vulnerable to unauthenticated PHP object injection in versions up to 3.7.4, which can be leveraged for RCE if secondary plugins provide a viable POP chain.